#include "../Base.h"




ULONG_PTR FindIndexDo(ULONG_PTR funAddress,int offset) {

	ULONG_PTR index = -1;
	do {

		if (!funAddress) break;
		PVOID base = NULL;
		SIZE_T size = PAGE_SIZE;
		NTSTATUS status = ZwAllocateVirtualMemory(NtCurrentProcess(), &base, 0, &size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
		if (!NT_SUCCESS(status)) break;
		SIZE_T proc = NULL;
		memset(base, 0, NULL);

		status = MmCopyVirtualMemory(IoGetCurrentProcess(), (PVOID)funAddress, IoGetCurrentProcess(), base, 0x300, UserMode, &proc);
		if (!NT_SUCCESS(status)) break;
		if (IsWin7()) {
			if (offset!= 0) {
				PUCHAR temp = (PUCHAR)base + offset;
				for (int i = 0; i < 200; i++)
				{
					if (temp[i] == 0x4c && temp[i + 1] == 0x8B && temp[i + 2] == 0xD1) {
						index = *(int*)(temp + i + 4);
						break;
					}
				}
			}
			else {
				index = *(int*)((PUCHAR)base + 0x4);
			}
			
		}
		else {
			index = *(int*)((PUCHAR)base + 0x4);
		}



		ZwFreeVirtualMemory(NtCurrentProcess(), &base, &size, MEM_RELEASE);
	} while (0);

	return index;
}

char* GetModuleName() {

	if (IsWin7()) {
		return "user32.dll";
	}
	else {
		return "win32u.dll";
	}
}

ULONG_PTR FindIndex(char* funcName,int offset) {
	ULONG_PTR index = -1;
	char* moduleName = GetModuleName();
	PEPROCESS process = FindProcess("YDArk.exe");
	if (!process) return -1;
	ULONG_PTR imageBase = 0;
	KAPC_STATE apc_state;
	KeStackAttachProcess(process, &apc_state);
	do {
		GetModuleInfo(PsGetProcessId(process), moduleName, &imageBase, NULL);
		if (!imageBase) {

			break;
		}

		ULONG_PTR funAddress = ExportProcAddressByModuleBase(imageBase, funcName, TRUE);
		if (!funAddress) break;
		index = FindIndexDo(funAddress, offset);
	}while (0);
	KeUnstackDetachProcess(&apc_state);
	ObDereferenceObject(process);
	return index;
}
ULONG_PTR GetUserFindWindowExIndex()
{
	static int index = -1;
	if (index != -1) return index;
	char* funcName = NULL;
	if (IsWin7()) {
		funcName = "SetThreadDesktop";
	}
	else {
		funcName = "NtUserFindWindowEx";
	}
	index = FindIndex(funcName, 11);
	return index;
}

ULONG_PTR GetNtUserQueryWindowIndex()
{
	static int index = -1;
	if (index != -1) return index;
	char* funcName = NULL;
	if (IsWin7()) {
		funcName = "GetWindowLongW";
	}
	else {
		funcName = "NtUserQueryWindow";
	}
	index = FindIndex(funcName, -0x60);
	return index;
}


ULONG_PTR  GetUserGetForegrounWindowIndex() {

	static int index = -1;
	if (index != -1) return index;

	char* funcName = NULL;
	if (IsWin7()) {
		funcName = "GetForegroundWindow";
	}
	else {

		funcName = "NtUserGetForegroundWindow";
	}

	index = FindIndex(funcName, 0);
	return index;
}


ULONG_PTR GetNtUserWindowFromPointIndex()
{
	static int index = -1;
	if (index != -1) return index;

	char* funcName = NULL;
	if (IsWin7()) {
		funcName = "WindowFromPoint";
	}
	else {

		funcName = "NtUserWindowFromPoint";
	}

	index = FindIndex(funcName, 0);
	return index;
}

ULONG_PTR GetNtUserBuildHwndListIndex()
{
	static int index = -1;
	if (index != -1) return index;

	char* funcName = NULL;
	if (IsWin7()) {
		funcName = "EnumDisplayMonitors";
	}
	else {

		funcName = "NtUserBuildHwndList";
	}

	index = FindIndex(funcName, 11);
	return index;
}

ULONG_PTR GetUserGetForegrounWindow()
{
	static ULONG_PTR address = 0;
	if (address) return address;

	address = GetSssdtFcunAddress(GetUserGetForegrounWindowIndex());
	return address;
}

ULONG_PTR GetUserFindWindowEx()
{
	static ULONG_PTR address = 0;
	if (address) return address;
	address = GetSssdtFcunAddress(GetUserFindWindowExIndex());
	return address;
}

ULONG_PTR GetNtUserQueryWindow()
{
	static ULONG_PTR address = 0;
	if (address) return address;
	address = GetSssdtFcunAddress(GetNtUserQueryWindowIndex());
	return address;
}

ULONG_PTR GetNtUserWindowFromPoint()
{
	static ULONG_PTR address = 0;
	if (address) return address;
	address = GetSssdtFcunAddress(GetNtUserWindowFromPointIndex());
	return address;
}

ULONG_PTR GetNtUserBuildHwndList()
{
	static ULONG_PTR address = 0;
	if (address) return address;
	address = GetSssdtFcunAddress(GetNtUserBuildHwndListIndex());
	return address;
}

